OPSEC 101 All guides

THE FULL KIT · CIPHER

Make and use a paper one-time pad with dice for private messages

Make a true one-time pad with ordinary dice, share it in person, and encrypt and decrypt private messages by hand.

Checked 4 Oct 2026 · 9 min read

This guide walks you and one trusted partner through making a real one-time pad with ordinary dice, handing it over, and using it to encrypt and decrypt short messages by hand. Making the pad takes an evening; each message takes a few minutes. No app, account or computer is involved.

Why bother

Almost every cipher you use daily is safe because breaking it would take too much computing power. The one-time pad is different. In 1949 Claude Shannon proved that if the key is truly random, as long as the message, kept secret and never reused, the ciphertext tells an attacker nothing about the message, no matter how much computing power they have, quantum computers included. The price is that every rule must be followed exactly. The Soviet Union learned this when duplicated pad pages let US analysts, over the following decades, read part of their 1940s traffic. Doing it once yourself shows you exactly what "perfect secrecy" costs, and gives you a channel for short, high-value notes that does not depend on any software being safe.

Before you start

Steps

1 Agree the rules in person

Sit down with your partner and agree, on paper you will later destroy:

  1. Alphabet: only the 26 letters A to Z. Drop spaces and punctuation, write numbers as words (TWO not 2).
  2. Letter numbers: A=0, B=1 ... Z=25 (the full list is in Step 6).
  3. Two pads, one per direction. Pad A is only for messages from you to your partner, pad B only for messages back. That way you can never both use the same page by accident.
  4. Page numbering: every key page gets a pad letter and number, like A-01, A-02. Each message starts with the page ID it used.
  5. Fixed length: every message is exactly 50 letters (or another number you pick), so length does not give anything away.
  6. End marker: the message ends with the fixed group XQXQ, and the rest is filler. XQXQ does not occur in normal English, so the reader can stop at the first one. If your text itself would end in XQ, rephrase the last word so the marker cannot start early.
  7. Long messages: one page holds 46 message letters plus the marker. If yours is longer, shorten it, or split it across consecutive unused page IDs (A-03, A-04). Fill each part with message letters, put XQXQ only in the last part, encrypt each part only with its own page, and destroy every page after use.

You can agree these rules at the same meeting where you swap pads in Step 4. You should now have one short rules sheet that both of you understand.

2 Roll the key with dice

Work on a single loose sheet on a hard surface, not on a notepad, so the pen does not leave readable dents in the sheets underneath.

Shake both dice in the cup and roll. Read the red die first, then the white die, and look up the letter:

Red 1: White 1-6 = A B C D E F
Red 2: White 1-6 = G H I J K L
Red 3: White 1-6 = M N O P Q R
Red 4: White 1-6 = S T U V W X
Red 5: White 1 = Y, White 2 = Z, White 3-6 = roll again
Red 6: any white = roll again

Each of the 36 possible rolls is equally likely, and exactly one roll gives each letter, so every letter has the same chance. The rerolls are what keep it fair; do not skip them or remap them to letters.

Write the letters in groups of five, five groups per line, which is 25 letters per line and 50 letters per two lines. Write the page ID at the top. For a 50-letter message you need exactly 50 key letters per page, one per message letter; a longer message split under rule 7 uses one whole page per 50-letter part.

You should now have pages like A-01, each full of five-letter groups from the dice.

Steps 3 and on are in the full guide

  1. Make exactly one copy of each page
  2. Hand over and store the pads
  3. Write the message
  4. Encrypt it, one letter at a time
  5. Check your work before sending
  6. Destroy the key page and the draft, then send
  7. Your partner decrypts and destroys their page

Open the full guide

Free with the opsec.101 newsletter: a few emails a month, unsubscribe anytime.

Watch the 60-second version →